what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Linux Security Advisory 1691-1

Debian Linux Security Advisory 1691-1
Posted Dec 30, 2008
Authored by Debian | Site debian.org

Debian Security Advisory 1691-1 - Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution.

tags | advisory, remote, vulnerability, code execution, xss
systems | linux, debian
advisories | CVE-2007-3555, CVE-2008-1502, CVE-2008-3325, CVE-2008-3326, CVE-2008-4796, CVE-2008-4810, CVE-2008-4811, CVE-2008-5432
SHA-256 | 157ae4c1f93c80363f5da2039e5008842435f365223797ef677fa7894c54dcf7

Debian Linux Security Advisory 1691-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1691-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
December 22, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : moodle
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2007-3555 CVE-2008-1502 CVE-2008-3325 CVE-2008-3326
CVE-2008-4796 CVE-2008-4810 CVE-2008-4811 CVE-2008-5432
Debian Bugs : 432264 471158 489533 492492 504235 504345 508593

Several remote vulnerabilities have been discovered in Moodle, an online
course management system. The following issues are addressed in this
update, ranging from cross site scripting to remote code execution.

Various cross site scripting issues in the Moodle codebase
(CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432,
MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806,
MDL-10276).

Various cross site request forgery issues in the Moodle codebase
(CVE-2008-3325, MSA-08-0023).

Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

SQL injection issue in the hotpot module (MSA-08-0010).

An embedded copy of Smarty had several vulnerabilities
(CVE-2008-4811, CVE-2008-4810).
An embedded copy of Snoopy was vulnerable to cross site scripting
(CVE-2008-4796).
An embedded copy of Kses was vulnerable to cross site scripting
(CVE-2008-1502).

For the stable distribution (etch), these problems have been fixed in
version 1.6.3-2+etch1.

For the unstable distribution (sid), these problems have been fixed in
version 1.8.2.dfsg-2.

We recommend that you upgrade your moodle (1.6.3-2+etch1) package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.diff.gz
Size/MD5 checksum: 24019 d29c179786ca1dcadf232c5e9a601362
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3.orig.tar.gz
Size/MD5 checksum: 7465709 2f9f3fcf83ab0f18c409f3a48e07eae2
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.dsc
Size/MD5 checksum: 793 d9a1fceaf316b608709be372d97e667a

Architecture independent packages:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1_all.deb
Size/MD5 checksum: 6592474 9a5fb5924faa639952c3171665bc347d


These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBSU9O3Wz0hbPcukPfAQJEwwf9Hw1Rvt1FLIzzB4OsBKS91yaM+lqDwmfu
pi7w5JXmc42AmaoVRCs23LxyqC30qV+vO3ZheYM7qgCZcrdpsWnYCOTy8Var6T0U
hdeE7UeRdlaCMkMEHt505YxNMy7h0Z3HmhZB8ysuSTT9iQ2AAZMeUFJB1MUM/Yf2
8GiQcnIJMcaM8je0M7bjqzSYTA6H8EIuqZZk88FJHhWinMZLWGnKqUoG7cnFfOVd
b0hKY093yf6hNT1pzx5a/a3PaKGjppGtZ+NnaBI8Q7YJvltqBb5lztWXFHuEJCWg
4Oo86NEb8/ARXGxugv0MUFvGPULfMVOTtnvF2BuTZLGZuvprofLy6Q==
=kHvM
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close